JobUncover
Start free
How it worksPricingFAQLog in
English
EnglishDeutschFrançaisEspañolItaliano

Privacy

Last updated: 2 October 2026

Who is responsible

JobUncover is operated by Krox Group d.o.o. (KROX GROUP DOO NIŠ), Hajduk Stanka 8, 18000 Niš, Serbia. We are the data controller for the personal data described here. Write to support@jobuncover.app with any question about your data or this policy. We have not appointed a data protection officer. We are not required to.

Summary

  • Your CV, your profile and the job postings you give us are used for one thing: preparing your application. We never apply, message or contact anyone for you.
  • The text of your CV and the posting is processed by Anthropic, our AI provider, on our behalf. It is not used to train AI models.
  • Nothing is sold. The one third-party script on this site is Meta's pixel, which measures our ads; in the EU, the UK and Switzerland it runs only if you accept it, and you can turn it off at any time.
  • You can delete everything yourself, at any time, from your account settings. Deletion is immediate.

What we collect

Account. Your email address, a hash of your password (never the password itself), the language you use the product in, and whether you confirmed your email. If you sign in with Google, Apple or Facebook, we receive your name, email and the provider's account id, nothing else.

Sessions. Each sign-in creates a session record with the time, the IP address and the browser it came from, so that we can spot and block abuse. A session lasts 30 days or until you sign out.

Profile. The work history, education, skills and achievements we extract from the CV you upload, your answers to the onboarding questions, and the preferences you set.

Files and documents. The CV file as you uploaded it, and the tailored CVs, cover letters and interview notes we generate for you, in the formats you can download.

Applications. For every application: the job posting you pasted or the link you gave us and the text we read from it, the fit analysis, each step the run went through, how long it took and what it cost in credits. A posting may name a recruiter or a contact person. We keep that text as part of your application and do not process those people's details for any other purpose.

Purchases. When you buy credits, our payment provider, Dodo Payments, Inc. (United States), sends us the order id, the package, the amount, the currency and the country used for tax. Your card or bank details never reach us.

Support. If you write to us, or report a problem from inside the product, we keep the message and our reply for as long as we need to resolve it and to show what was agreed.

Operational logs. The worker that prepares your application records which step ran, whether it succeeded, and the error if it failed. Our web server does not keep access logs. A failed run creates an alert for us that names the application and the error.

  • Running your account and preparing your applications. Account, profile, files, applications. Basis: performance of a contract, Art. 6(1)(b) GDPR.
  • Taking payment and keeping financial records. Purchases, credit ledger. Basis: contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).
  • Keeping the service secure. Sessions, operational logs, the domain of your email address, to block abuse, disposable addresses and excessive requests. Basis: legitimate interest, Art. 6(1)(f).
  • Answering you. Support messages. Basis: contract and legitimate interest.
  • Emails about your account. Confirmation of your address and password resets. Basis: contract, Art. 6(1)(b).
  • Measuring our advertising. Meta's pixel and the events our server sends to Meta, described under Cookies. Basis: consent, Art. 6(1)(a), in the EU and EEA, the UK and Switzerland; legitimate interest, Art. 6(1)(f), with the right to object, elsewhere.

We do not send marketing emails. Beyond that advertising measurement, we do not profile you for advertising. We do not make decisions about you that have legal or similarly significant effects: every document is a draft that you review and decide about yourself.

How the AI processing works

To extract your profile, to check your fit and to draft your documents, we send your CV text, your profile, the job posting and your answers to Anthropic, PBC (United States), through its API. Anthropic processes this data only on our instructions under a data processing agreement, and under its commercial terms does not use it to train models.

For the packages that include company research, Anthropic also runs web searches on our behalf with the company name and the role. The research notes and the salary range we get back are stored for 30 days in a cache keyed by company and role, so that the next person applying to the same company does not pay for the same searches. That cache holds public information about the company, not anything about you.

Data sent to Anthropic leaves the EU. The transfer rests on the European Commission's standard contractual clauses in Anthropic's data processing agreement, with Anthropic's additional safeguards.

Who else receives data

  • Anthropic, PBC, United States: the AI processing described above.
  • Hetzner Online GmbH, Germany: hosting of the application, the database and your files, and server backups.
  • Migadu Mail GmbH, Switzerland: sending the emails we send you.
  • Dodo Payments, Inc. (United States), our payment provider: payment processing as merchant of record. Its own privacy policy applies on the checkout pages.
  • Google, Apple or Meta, United States: only if you choose to sign in with their account.
  • Meta Platforms Ireland Ltd., Ireland, and Meta Platforms, Inc., United States: measurement of our advertising, as described under Cookies, and only with your consent where the law requires it.

Switzerland has an EU adequacy decision. Transfers to the United States rest on standard contractual clauses or, where the recipient is certified, the EU-US Data Privacy Framework.

We do not sell personal data and we do not share it with data brokers. What reaches Meta for advertising measurement is described under Cookies. We disclose data to authorities only when the law requires it.

How long we keep it

Until you delete it. Your account, profile, files, documents and applications stay as long as your account exists. Nothing is deleted automatically while you are a member.

Deleting your account removes your profile, your uploaded CV, your generated documents, your applications, your sessions and your login in one step, immediately, from Settings. Purchase records and the credit ledger are kept but anonymized, because we must keep financial records for the period tax law requires (up to ten years). After deletion they can no longer be linked to you.

Backups. Database backups are kept for 14 days and server snapshots for 7 days, so a deleted account disappears from backups within 14 days. Backups are never restored into the live service except to recover from a failure.

Research cache. Company and salary research is kept for 30 days and holds no personal data of yours.

Support messages are kept for up to two years after the last exchange.

Cookies and local storage

Strictly necessary, set without asking:

  • a session cookie that keeps you signed in, for 30 days or until you sign out,
  • a language cookie that remembers which language you chose, for one year,
  • a ju-consent cookie that remembers your answer to the advertising question below, for six months,
  • a ju-ref cookie that remembers which link brought you here (a referral code, campaign parameters, the click id of an ad platform), for 90 days, so that we can tell which partner or campaign a sign-up came from,
  • a ju-theme entry in your browser's local storage that remembers light or dark mode.

Advertising measurement: Meta's pixel. We advertise on Facebook and Instagram and use Meta's pixel to see which ads bring people who sign up. When it runs, it sets the cookies _fbp (an identifier for your browser) and _fbc (the id of the ad you clicked), both for 90 days, and sends Meta the pages you view and the click on our sign-up button, together with your IP address and browser information. When you then verify your email address, start an application or make a purchase, our server tells Meta that this happened, with your email address and account id in hashed form and the pixel's two values, so that Meta can attribute it to the ad. Meta also uses this data for its own purposes, described in Meta's privacy policy; for the collection, Meta Platforms Ireland Ltd. and we are joint controllers under Meta's terms for business tools.

  • In the EU and EEA, the UK and Switzerland the pixel runs only after you click Accept in the bar at the bottom of the page. Basis: consent, Art. 6(1)(a) GDPR. Declining has no other consequence.
  • Everywhere else it runs when you arrive, and the bar lets you turn it off. Basis: legitimate interest in measuring our advertising, Art. 6(1)(f), with the right to object.

You can change your answer at any time with the Cookies link in the footer. Turning the pixel off stops it and removes its two cookies; what was already sent cannot be recalled.

Our own counters. The campaign landing page counts its views and the clicks on its button on our own server, with the country of your address and the campaign parameters, and nothing else: no address, no identifier, no cookie. The country comes from DB-IP's free database (db-ip.com); the address itself is not stored.

Dodo Payments sets its own cookies on its checkout pages.

Your rights

Under the GDPR you can ask us to:

  • tell you what data we hold about you and give you a copy (access),
  • correct it (rectification),
  • delete it (erasure), which you can also do yourself from Settings,
  • give it to you in a machine-readable form (portability): your documents are downloadable from each application, and we will export the rest on request,
  • restrict or object to processing that rests on our legitimate interest.

Write to support@jobuncover.app. We answer within one month. You can also complain to a data protection authority, either the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or the authority where you live.

Security

All traffic is encrypted (TLS). Passwords are stored as salted hashes. Your files are stored on our own server in the EU, outside the public web root, and are served only to your signed-in session. Access to production systems is limited to the people who run the service. Sign-in and password endpoints are rate limited, and disposable email domains are refused at sign-up.

Children

JobUncover is for people looking for work and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

Changes

When this policy changes we update the date at the top. If a change matters to you, for example a new recipient of your data, we email you before it takes effect.